Overview
overview
8Static
static
3Era Setup 3.0.9.exe
windows10-2004-x64
8Era Setup 3.0.9.exe
windows11-ltsc_2024-x64
8$PLUGINSDI...ry.dll
windows10-2004-x64
3$PLUGINSDI...ry.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows11-ltsc_2024-x64
3Era V3.exe
windows10-2004-x64
7LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-ltsc_2024-x64
3d3dcompiler_47.dll
windows10-2004-x64
1dxcompiler.dll
windows10-2004-x64
1dxil.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1locales/th.ps1
windows10-2004-x64
3locales/th.ps1
windows11-ltsc_2024-x64
3resources/...li.exe
windows10-2004-x64
1resources/...li.exe
windows11-ltsc_2024-x64
1resources/...er.exe
windows10-2004-x64
1resources/...er.exe
windows11-ltsc_2024-x64
1resources/...or.dll
windows10-2004-x64
1resources/...or.dll
windows11-ltsc_2024-x64
1resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-ltsc_2024-x64
3resources/...ker.js
windows10-2004-x64
3resources/...ker.js
windows11-ltsc_2024-x64
3resources/...ker.js
windows10-2004-x64
3Analysis
- max time kernel
149s - max time network
176s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 07:51
Static task
static1
Behavioral task
behavioral1
Sample
Era Setup 3.0.9.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Era Setup 3.0.9.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Registry.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Registry.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
Era V3.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
LICENSES.chromium.html
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
LICENSES.chromium.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral16
Sample
d3dcompiler_47.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
dxcompiler.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
dxil.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
ffmpeg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
locales/th.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
locales/th.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral22
Sample
resources/app.asar.unpacked/node_modules/@sentry/cli/node_modules/@sentry/cli-win32-x64/bin/sentry-cli.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
resources/app.asar.unpacked/node_modules/@sentry/cli/node_modules/@sentry/cli-win32-x64/bin/sentry-cli.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral24
Sample
resources/binaries/FortniteLauncher.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
resources/binaries/FortniteLauncher.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral26
Sample
resources/build/Release/dll_injector.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
resources/build/Release/dll_injector.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral28
Sample
resources/elevate.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
resources/elevate.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral30
Sample
resources/workers/diskWriterWorker.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
resources/workers/diskWriterWorker.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral32
Sample
resources/workers/downloadWorker.js
Resource
win10v2004-20260513-en
windows10-2004-x64
General
- Target Era V3.exe
- Size 201.1MB
- Sample260810-jp87layvcx
- SHA256 c9eeaa76c621ef3ddfbb67629f003f2525cca716284019bf846b0e62a069ff6b
- MD5 36164c7bf465ac9e8e699fc7d5b59a07
- SHA1 0b0689ea3d78f189e93b71cd7f5104eab41a799c
- SHA512 37b28c3da011bdaa3a0cadf06def3c7ab659481ce631bd7c89198df73da32c69b20c1378f3f3ec84017d96515bacf82d6e2a9cf9e5fce00e8eea1db46e83bd0e
- SSDEEP 1572864:NPfm31RV7UxMlZE9keIhkYLc7N49dEK+5Gof9IP554PxLom+gsT6BwLFFagWLmIR:xoba28xLL9516bAM
- TLSH T1E2A87B03E29A41D9E06DD175974A9633FE71B8094B24B2DF2B9407522F77EE42B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation Era V3.exe Key value queried \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation Era V3.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3424 cmd.exe - Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString Era V3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz Era V3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Era V3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString Era V3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString Era V3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz Era V3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 Era V3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString Era V3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz Era V3.exe - Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\fluxapp\shell\open\command Era V3.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\fluxapp\shell Era V3.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\fluxapp\shell\open Era V3.exe Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\fluxapp\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Era V3.exe\" \"%1\"" Era V3.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\fluxapp Era V3.exe Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\fluxapp\URL Protocol Era V3.exe Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\fluxapp\ = "URL:fluxapp" Era V3.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2444 Era V3.exe 2444 Era V3.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe Token: SeShutdownPrivilege 5556 Era V3.exe Token: SeCreatePagefilePrivilege 5556 Era V3.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5556 wrote to memory of 1444 5556 Era V3.exe 89 PID 5556 wrote to memory of 5188 5556 Era V3.exe 90 PID 5556 wrote to memory of 5188 5556 Era V3.exe 90 PID 5556 wrote to memory of 6064 5556 Era V3.exe 91 PID 5556 wrote to memory of 6080 5556 Era V3.exe 92 PID 5556 wrote to memory of 3980 5556 Era V3.exe 94 PID 5556 wrote to memory of 3424 5556 Era V3.exe 97 PID 3424 wrote to memory of 3256 3424 cmd.exe 99 PID 5556 wrote to memory of 2444 5556 Era V3.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\Era V3.exe"C:\Users\Admin\AppData\Local\Temp\Era V3.exe"1⤵
- Checks computer location settings
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\Era V3.exe"C:\Users\Admin\AppData\Local\Temp\Era V3.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\era /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\era\Crashpad --url=https://f.a.k/e --annotation=_productName=era --annotation=_version=3.0.9 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=39.1.1 --initial-client-data=0x530,0x508,0x52c,0x45c,0x534,0x7ff710042a4c,0x7ff710042a58,0x7ff710042a682⤵PID:1444
-
-
C:\Users\Admin\AppData\Local\Temp\Era V3.exe"C:\Users\Admin\AppData\Local\Temp\Era V3.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\era" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,12725343665509844978,5038637309484192712,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1900 /prefetch:22⤵PID:5188
-
-
C:\Users\Admin\AppData\Local\Temp\resources\binaries\FortniteLauncher.exeC:\Users\Admin\AppData\Local\Temp\resources\binaries\FortniteLauncher.exe2⤵PID:6064
-
-
C:\Users\Admin\AppData\Local\Temp\Era V3.exe"C:\Users\Admin\AppData\Local\Temp\Era V3.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\era" --standard-schemes=app --secure-schemes=app,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=app,sentry-ipc --fetch-schemes=app,sentry-ipc --service-worker-schemes=app --field-trial-handle=1904,i,12725343665509844978,5038637309484192712,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2316 /prefetch:32⤵PID:6080
-
-
C:\Users\Admin\AppData\Local\Temp\Era V3.exe"C:\Users\Admin\AppData\Local\Temp\Era V3.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\era" --standard-schemes=app --secure-schemes=app,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=app,sentry-ipc --fetch-schemes=app,sentry-ipc --service-worker-schemes=app --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1786348524277712 --launch-time-ticks=542824014 --field-trial-handle=1904,i,12725343665509844978,5038637309484192712,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2768 /prefetch:12⤵
- Checks computer location settings
PID:3980
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64" /v "Installed""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64" /v "Installed"3⤵PID:3256
-
-
-
C:\Users\Admin\AppData\Local\Temp\Era V3.exe"C:\Users\Admin\AppData\Local\Temp\Era V3.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\era" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,12725343665509844978,5038637309484192712,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2600 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2444
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\era\Network\Network Persistent State
- Size 1KB
- SHA256 4f1ca42813511fb6b4486c3de58e4584666acbea64874b2674d7eb6aa4c72cce
- MD5 fb3a4ff5fee141cf0621968b9262a551
- SHA1 fd11743708c6ebced71d7d5301010f4743bb46a6
- SHA512 d2404595091d32cb3f7020b784b506866121ed8f17447b3c464f7318dccb43eb3cf468b5179b2fe2cb6e246fca7f5edc9a2b5e232eaf4b544d5b227e7d83dd6a
- TLSH T11A218BDACBE9467D49A297F12E253923D5AE091C12383C06DAD8DF8F57F1C75860114E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\era\Network\Network Persistent State~RFe59af22.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\era\Session Storage\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512